Introduction 


In the National Health Service in England, we aim to provide 
you with the highest quality of healthcare. To do this, we must 
keep records about you, your health and the care we have 
provided to you or plan to provide to you. NHS care records 
may be electronic, on paper or a mixture of both, and 
organisations use a combination of working practices and 
technology to keep to this guarantee. 


This guarantee is our commitment that we will use records 
about you in ways that respect your rights and promote 
your health and wellbeing. 


The people who care for you use your records to: 


e provide a good basis for all health decisions made by 
you and healthcare professionals; 


e allow you to work with those providing care; 
e make sure your care is safe and effective; and 
e work effectively with others providing you with care. 


Others may also need to use records about you to: 

e check the quality of care (such as a clinical audit); 
e protect the health of the general public; 

e keep track of NHS spending; 

e manage the health service; 


e help investigate any concerns or complaints you 
or your family have about your healthcare; 


e teach healthcare professionals; and 
e help with research. 
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You have the right: 


e to confidentiality under the Data Protection Act 1998, the 
Human Rights Act 1998 and the common law duty of confidence 
(the Disability Discrimination Act 2005 and the Race Relations 
Act 1976 and Amendment 2000 may also apply); 


e to ask for a copy of all records about you held in paper or 
electronic form (you may have to pay a fee); and 


e to choose someone to make decisions about your healthcare 
if you become unable to do so (this is called ‘a lasting power 
of attorney’). 

We have a duty to: 


@ maintain full and accurate records of the care we provide 
to you; 


e keep records about you confidential, secure and accurate; and 
e provide information in a format that is accessible to you 

(for example, in large type if you are partially sighted). 
It is good practice for people in the NHS who provide your care to: 


e discuss and agree with you what they are going to record 
about you; 


° give you a copy of letters they are writing about you; and 


e show you what they have recorded about you, if you ask. 
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The NHS Care Records Service 


Some of your health records are already held on computer, 
but many are still kept on paper. While the paper records 

we keep are protected by strict confidentiality and security 
procedures, these records are not always available to the care 
team looking after you. Handwritten entries in the record may 
be difficult to read and important information may be missing. 
The National Programme for IT is introducing modern secure 
computer systems into the NHS over the next few years. 


Some of these will hold electronic health records about you, 
making them available to the right people where and when 
they are needed for your healthcare, while maintaining your 
confidentiality and keeping your information secure. They are 
often referred to as the NHS Care Records Service. 


This new system will: 


e allow you to control whether the information recorded about 
you by an organisation providing you with NHS care can be seen 
by other organisations that are also providing you with care; 


e show only those parts of your record needed for your care; 


e allow only authorised people (who will need a ‘smartcard’ 
as well as a password) to access your record; 


e allow only those involved in your care to have access to 
records about you from which you can be identified, unless 
you give your permission or the law allows; 


e allow us to use information about your healthcare, in a way 
that doesn’t make your identity known, to improve the 
services we offer or to support research; 
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e keep a note of everyone who accesses the records about 
you; and 


e be operated in line with internationally approved 
information security standards. 


The Summary Care Record 


Your Summary Care Record is part of the NHS Care Records 
Service. It contains information from your care record (current 
prescriptions, allergies, reactions to treatment) and any other 
information that you have agreed should be included. This means 
that wherever in the country you need care those providing it can 
have access to the most up-to-date information. 


We will ask your permission if we need to look at information 
in your Summary Care Record. When this is not possible, for 
example in an emergency when you are unconscious, we will 
teli you later. 


You will be informed when Summary Care Records are introduced 
into your area. Before we create the Summary Care Record, you 
can decide not to have a Summary Care Record at all. 


After we have created your Summary Care Record, you can decide: 


e not to share the information in it; 


e to share the information in it with others providing you 
with care; or 


e to add information from your other health records that 
you would like included. 


If you have a Summary Care Record, it is available to you at all 
times, free of charge, over a secure internet connection through 
the service called ‘HealthSpace’ (www.healthspace.nhs.uk). 
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Our 12 commitments to you: 


1 


When we receive a request from you in writing, we must 
normally give you access to everything we have recorded 
about you. We may not give you confidential information 
about other people, or information that a healthcare 
professional considers likely to cause serious harm to the 
physical or mental health of you or someone else. This applies 
to paper and electronic records. However, if you ask us to, 

we will let other people see health records about you. 


Wherever possible, we will make your health records 
available to you free of charge or at a minimum charge, 
as allowed by law. We will provide other ways for you to 
apply to see your records if you cannot do so in writing. 


We will provide information in a format that is accessible to 
you (for example, in large type if you are partially sighted). 


When we provide healthcare, we will share your record 
with the people providing care or checking its quality 
(unless you have asked that we limit how we share your 
record). Everyone looking at your record, whether on paper 
or computer, must keep the information confidential. 


We will aim to share only as much information as people 
need to know to play their part in your healthcare. 


We will not share health information that identifies you 
(particularly with other government agencies) for any 
reason other than providing your care, unless: 


you ask us to do so; 
we ask and you give us specific permission; 


we have to do this by law; 
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e we have special permission for health or research purposes; or 


e we have special permission because the public good is 
thought to be of greater importance than your confidentiality. 


If we share information without your permission, we will make 
sure that we keep to the Data Protection Act 1998, the NHS 
confidentiality code of practice and other national guidelines 
on best practice. There is more information about existing 
guidelines at: 
www.dh.gov.uk/en/Managingyourorganisation/Informationpolicy/ 
Patientconfidentialityandcaldicottguardians/index.htm 


4 Under current law, no-one else can make decisions on your 
behalf, about sharing health information that identifies you. 
At the moment, the only exceptions to this are parents or 
legal guardians, or people with powers under mental health 
or other law. You can appoint someone to have a lasting 
power of attorney to make decisions for you if you lose the 
ability to make decisions for yourself. You can decide what 
rights that person has in making decisions about your care 
record. If you do not appoint anyone, a senior healthcare 
professional involved in your care may consider it to be in 
your best interests to share information. This judgment 
should take account of the views of your relatives and 
carers, and any views you have already recorded. For medical 
research or other purposes (see the box on page 7), the 
Ethics and Confidentiality Committee of the National 
information Governance Board for Health and Social Care 
can give special permission to share any health information 
that could identify you. 
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| When we might use or share information 
that names you without asking you 


| O Sometimes we have a legal duty to give information 
| about people. Examples include: 


- births of children; 
- reporting some infectious diseases; 


- reporting gunshot wounds to the police; or 


- because a court orders us to do so. 


| © Sometimes special permission will be given to use your 
information without your consent. This may be for medical | 
research, keeping registers of cancer patients or checking 
quality of care. This permission is given by the Ethics and 
Confidentiality Committee of the National Information 
Governance Board for Health and Social Care. 


| O Special permission may also be given when the public 

good is thought to be of greater importance than your 
confidentiality. This is very rare, but some situations where — 
this might happen include: 


- when a serious crime has been committed; 


- when there are serious risks to the public or NHS staff; or | 


- to protect children. 


Other than in the most exceptional circumstances, this 
permission is given by the senior clinician in charge of 
protecting your privacy in each health or care organisation. 
(Often this person will be called the Caldicott Guardian.) 
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5 Sometimes your healthcare will be provided by members 
of a care team, which might include people from other 
organisations such as social services or education. We will 
tell you if this is the case. When it could be best for your 
care for your health information to be shared with 
organisations outside the NHS, we will agree this with you 
beforehand. If you don't agree, we will discuss with you the 
possible effect this may have on your care and alternatives 
available to you. 


6 Usually you can choose to limit how we share the information 
in your care records which identifies you. In helping you 
decide, we will discuss with you how this may affect our ability 
to provide you with care or treatment, and any alternatives 
available to you. 


7 Wewill deal fairly and efficiently with your questions, 
concerns and complaints about how we use information 
about you. All trusts have a Patient Advice and Liaison 
Service (PALS) which can answer questions, point people 
towards sources of advice and support, and advise on how 
to make a complaint. We will have a clear complaints 
procedure. We will use what we learn from your concerns 
and complaints to improve services. 
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8 We will take appropriate steps to make sure information 
about you Is accurate. You will be given opportunities to 
check records about you and point out any mistakes. We will 
normally correct factual mistakes. If you are not happy with 
an opinion or comment that has been recorded, we will add 
your comments to the record. If you feel you are suffering 
distress or harm as a result of information currently held in 
your record, you can apply to have the information 
amended or deleted. 


9 We will make sure, through contract terms and staff 
training, that everyone who works in or on behalf of the 
NHS understands their duty of confidentiality, what it 
means in practice and how it applies to all parts of their 
work. Organisations under contract to the NHS must follow 
the same policies and use the same controls as the NHS 
does. We will enforce this duty at all times. 


10 We will take appropriate steps to make sure we hold 
records about you — both paper and electronic — securely 
and only make them available to people who have a right 
to see them. 


11 We will keep a record of everyone who accesses the 
electronic information the NHS Care Records Service holds 
about your diagnosis, care and treatment. You will be able 
to ask for a list of everyone who has accessed records that 
identify you, and when they did so. 


There may be times when someone will need to look at 
information about you without having been given permission 
to do so beforehand. This may be justifiable, for example, 

if you need emergency care. We will tell you if the action 
cannot be justified. 
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12 If we find that someone has deliberately accessed records 
about you without permission or good reason, we will 
take action. This can include disciplinary action, ending a 
contract, firing an employee or bringing criminal charges. 
We will tell you if this happens. 
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Six things that you can do in return 


1 Help us to make sure that we have identified you 
correctly by letting us know when you change address or 
name and keeping a note of your unique NHS number. 


2 Tell us if any information in your record is wrong. 


Allow us to share as much information about you as we 
need to provide you with healthcare. 


4 \|f you have decided to limit how we share the information 
in your electronic care record with others, tell us if you 
change your mind. We will always try to provide you with 
the best possible care, but bear in mind that limiting the 
information we can share may make it more difficult. 


5 Only let others — insurers, mortgage lenders, employers, 
solicitors — look at your records If you are sure it is 
necessary for your purposes. Think carefully about who 
you give permission to and why. Try to restrict their 
access to what they need to know and no more. 


6 Atsome time, we might ask your permission to use 
information from your records from which you could be 
identified for important research. Please give us permission 
unless you feel strongly that you do not want us to use 
your information in this way. 
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For parents and young people 


Introduction 


Care records are important for the wellbeing of children and 
young people. Knowing about your child's health is important 
for parents. Parents include birth parents and anyone else who 
has been granted parental responsibility for a child by a court. 


As they grow up, children become more able to make 
decisions for themselves. They should be helped to do so and 
be involved in their healthcare whenever possible. You can 
get an illustrated leaflet about care records for younger 
children from www.nigb.nhs.uk 


Parents 


If you are a parent, we will let you see your child’s care 
record or give you a copy if you ask. If your child is able to 
understand and make decisions, we will ask for his or her 
agreement first. Your child’s care record will probably 
include some information about you. We will ask your 
permission before showing it to your child. You can choose 
to hide these parts of your child’s record from your child. 


Young person 


If you are a young person capable of understanding and 
making decisions for yourself, we will let you see your record 
or give you a copy if you ask. 


You can ask someone giving you care not to share information 
with your parents. We can agree to your request unless we 
think that it is not in your best interest. 
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Parents and young people 


We will encourage you and your child to make decisions 
about the care record together. If you disagree about who 
can see the care record, your hospital or GP practice will 
ask the advice of the Caldicott Guardian, who is responsible 
for protecting the privacy of patients. 


Sharing information 


When it is best for your child’s care to share health 
information with people who are not directly involved in 
their treatment or not in the NHS (such as social services 
or education), we will always ask you or your child before 
we do so. If you or your child don’t agree, we will discuss 
with you or your child the possible effect this may have 
on their care, and the alternatives available. 


Sometimes we do have to share information without your or 
your child’s permission, as shown on page 7. This is particularly 
when there is concern about the safety or welfare of the child 
and asking for permission could put the child at risk. 
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How do we make sure your electronic care 
record stays secure and confidential? 


e By controlling access: 


e Smartcards — NHS Care Records Service systems can only 
be accessed using a smartcard. We keep to the highest 
levels of security when we issue smartcards. A smartcard 
on its own is not enough to be able to access NHS Care 
Records Service systems — everyone with a Smartcard has 
a password which also identifies them. 


¢ Good reasons — There has to be a good reason (for 
example, being involved in providing your care) for 
someone to access the information in your record. 


e Access controls — The Smartcard also contains 
information about the job of the person it has been 
issued to. The amount of clinical information they can 
access is based on their job. 


e Audit trails —- Every time someone accesses your record, 
we keep a record of who they were and what entries 
they may have made. — 


By asking you to: 


¢ tell us if you don't want us to create a summary care 
record for you; 


e decide whether we can share the information contained 
in your summary care record; and 


e decide whether some of the entries in your record are 
so sensitive that you want to further control who can 
see them. 
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How to complain 


If you feel we are not following the commitments in the 
NHS Care Record Guarantee, you should tell us. You should 
write to the NHS organisation or GP responsible. When they 
receive your complaint, they will investigate it and send you 
their response. 


You can ask the Patient Advice and Liaison Service (PALS) 
office at your hospital trust or PCT for information and help. 
They may be able to deal with your concerns there and then, 
or give you details of how to take the matter further. 


Or, you can phone NHS Direct on 0845 4647 for information 
on how to make a complaint. 
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Plans for the future 


We plan to introduce ‘sealed envelopes’ into the electronic 
NHS Care Records Service over the next few years. This new 
feature will give you even more control over your record. 


If you are concerned about particular entries in your care 
record, you will be able to ask us to keep those parts of your 
record from general view in a sealed envelope. 


If you ask us to do this, the entries will always be able to be 
seen by the care team that created them. For information 
that identifies you, you can decide whether you want to do 
the following. 


e Allow other people outside the care team that created it 
to see that there is hidden information. This is called 
‘sealing’. They can ask for your permission to see sealed 
information, but you can refuse. In an emergency, if you 
are not able to give your permission, they can unseal it if 
they feel that your care justifies doing so. 


or 


e Allow no-one other than the team that created it to 
know that there is hidden information. This is called 
‘sealing and locking’. Sealed and locked information will 
not be available to other people, even in an emergency. 


We will not share those particular entries in a way that 
identifies you without your specific permission, except: 


e when we have a legal duty to give information about you; or 


e when we have special permission because the interest of 
the public is thought to be of greater importance than 
your confidentiality. 
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You can get more information about rights under the Data 
Protection Act from: 


The Information Commissioner's Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 


Phone: 01625 545 745. 
Information Commissioner's Office helpline: 08456 30 60 60 
Website: www.ico.gov.uk 


You can get more information about the Ethics and 
Confidentiality Committee of the National Information 
Governance Board for Health and Social Care from their 
website at www.nigb.nhs.uk 


The NHS Care Record Guarantee for England was first 
published in May 2005 by the Care Record Development 
Board, and revised and reissued in April 2006, August 2007 
and July 2009. This is version 4. The NHS Care Record 
Guarantee Is available in several languages other than 
English and is available to download from www.nigb.nhs.uk 


In autumn 2007 the Care Record Development Board closed 
and responsibility for reviewing and updating the NHS Care 
Record Guarantee for England moved to the National 
Information Governance Board for Health and Social Care. 


The National Information Governance Board for Health and 
Social Care (NIGB) is grateful to everyone who helped to 
revise this version of the Guarantee. 
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You can find out more about the NIGB on its website 
www.nigb.nhs.uk or you can contact the board: 


e by e-mail at nigb@nhs.net; 
e by phone on 0207 633 7052; or 
e by writing to: 


The National Information Governance Board 
for Health and Social Care 

7th Floor 

New King's Beam House 

22 Upper Ground 

London 

SE1 9BW. 


You can order printed copies of the NHS Care Record 
Guarantee for England through the online publication 
system at http://information.connectingforhealth.nhs.uk 
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